Auditd for the Masses Philipp Krenn @xeraa Learn about a breach - PowerPoint PPT Presentation

Nov 14, 2023 •428 likes •942 views

Auditd for the Masses Philipp Krenn @xeraa Learn about a breach From the press or users Learn about a breach Attackers asking for a ransom Learn about a breach Cloud provider's bill Learn about a breach Yourself after the

Auditd for the Masses Philipp Krenn �� @xeraa
Learn about a breach From the press or users
Learn about a breach Attackers asking for a ransom
Learn about a breach Cloud provider's bill
Learn about a breach Yourself after the fact
Learn about a breach Yourself but unsure about harm
Learn about a breach Yourself & you can prove no harm
No silver bullet
Questions: https://sli.do/xeraa Answers: https://twitter.com/xeraa
uditd https://github.com/linux-audit
"auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is done with the ausearch or aureport utilities."
Watching file access Monitoring system calls Recording commands run by a user Recording security events Monitoring network access
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/chap-system_auditing
Demo
More Rules https://github.com/linux-audit/audit- userspace/tree/master/rules
Namespaces WIP https://github.com/linux-audit/audit- kernel/issues/ 32#issuecomment-395052938
Problem How to centralize?
Infrastructure | Developer
Disclaimer I build highly monitored Hello World apps
Filebeat Module: Auditd
Demo
Auditbeat
Auditd Module Correlate related events Resolve UIDs to user names Native Elasticsearch integration
Auditd Module eBPF powers on older kernels Run side by side with Auditd Easier configuration
Docker metadata enrichment
Demo
File Integrity Module inotify (Linux) fsevents (macOS) ReadDirectoryChangesW (Windows)
hash_types blake2b_256 , blake2b_384 , blake2b_512 , md5 , sha1 , sha224 , sha256 , sha384 , sha512 , sha512_224 , sha512_256 , sha3_224 , sha3_256 , sha3_384 , sha3_512 , xxh64
Demo
See moar Kibana visualizations & dashboards
Demo
PS: Machine Learning
Conclusion
Auditd Auditbeat Logs, Dashboards,...
!
!"
https://cloud.elastic.co
Next Steps https://dashboard.xeraa.wtf SSH: elastic-user@xeraa.wtf secret
Questions? Philipp Krenn �� @xeraa PS: Sticker

Recommend

Aspects of neutrino masses Jessica Turner UCL 13 December 2019 Outline Neutrino masses and

Aspects of neutrino masses Jessica Turner UCL 13 December 2019 Outline Neutrino masses and mixing Consequences of neutrino masses Neutrino masses from gravity, what has been done Neutrino masses from gravity: the Schwinger Dyson

741 views • 52 slides

SOFTDRIVE.NL, SOFTDRIVE.NL, CVMFS FOR THE CVMFS FOR THE MASSES MASSES DENNIS VAN DOK DENNIS

SOFTDRIVE.NL, SOFTDRIVE.NL, CVMFS FOR THE CVMFS FOR THE MASSES MASSES DENNIS VAN DOK DENNIS VAN DOK Generic Components of the eScience Infrastructure Ecosystem 14th IEEE eScience Conference Amsterdam, Monday 2018-10-29 1 GRID

815 views • 18 slides

Pancreatic Mass: Solid or Cystic? Solid Pancreatic masses Cystic pancreatic masses -

Workshop -ROSE in EUS guided FNA of Pancreatic Lesions Guys Hospital, London, 16 April 2018 Laxmi Batav Imperial College NHS Trust Pancreatic Mass: Solid or Cystic? Solid Pancreatic masses Cystic pancreatic masses - Ductal

332 views • 11 slides

MassBrowser Unblock cking the Censored Web fo for the Masses, by the Masses Milad Nasr, Hadi

MassBrowser Unblock cking the Censored Web fo for the Masses, by the Masses Milad Nasr, Hadi Zolfaghari, Amir Houmansadr, Amirhossein Ghafari University of Massachusetts, Amherst 1 Internet Censorship 2 Censorship Circumvention Tools 3

827 views • 30 slides

Neutrino Masses from TeV Scale New Physics -- Tests of Neutrino Masses at the LHC Mu-Chun Chen,

Neutrino Masses from TeV Scale New Physics -- Tests of Neutrino Masses at the LHC Mu-Chun Chen, University of California at Irvine GGI Whats Nu?, June 26, 2012 Theoretical Challenges (i) Absolute mass scale: Why m << m u,d,e ?

543 views • 29 slides

Recursion for the Masses TCS Seminar WS19/20 Christoph Rauch Dec 10, 2019 Recursion for the

Recursion for the Masses Recursion for the Masses TCS Seminar WS19/20 Christoph Rauch Dec 10, 2019 Recursion for the Masses Introduction of Recursion to Students Early Stage (FAU) students are more or less expected to "know" what

603 views • 29 slides

Pole masses of Neutrinos in the GrimusNeufeld model Vytautas D ud enas Vilniaus

Pole masses of Neutrinos in the GrimusNeufeld model Vytautas D ud enas Vilniaus Universitetas In collaboration with Thomas Gajdosik, Darius Juriukonis September 6, 2019 1 / 16 Outline Model for masses 1 Pole mass calculation 2

427 views • 18 slides

Extended double seesaw model for neutrino masses and low scale leptogenesis. International

Extended double seesaw model for neutrino masses and low scale leptogenesis. International workshop on neutrino masses and mixing Decmeber 17-19 2006, Shizuoka, Japan Sin Kyu Kang (Sogang University) in collaboration with C. S. Kim

1.25k views • 25 slides

Slide 1 / 67 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are

Slide 1 / 67 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are separated by a distance of 25 m. Find the gravitational attraction between them. Slide 2 / 67 2 Two spherical objects have masses of 1.5 x 10 5 kg and

773 views • 23 slides

Slide 1 / 66 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are

Slide 1 / 66 1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are separated by a distance of 25 m. Find the gravitational attraction between them. Slide 2 / 66 2 Two spherical objects have masses of 1.5 x 10 5 kg and

537 views • 22 slides

1 Two spherical objects have masses of 200 kg and 500 kg. Their centers are separated by a

968 views • 67 slides

Models for Neutrino Masses and Physics Beyond Standard Model Salah Nasrj The 2nd Toyama

Models for Neutrino Masses and Physics Beyond Standard Model Salah Nasrj The 2nd Toyama International Workshop on Higgs as a Probe of New Physics 2015 (HPNP2015), Toyama, Japan February 12, 2015 1 / 27 . Salah Nasri Neutrino masses and

671 views • 27 slides

Landell - live streaming for the masses Luciana Fujii Pontello Landell - live streaming for the

Landell - live streaming for the masses Luciana Fujii Pontello Landell - live streaming for the masses 1 / 12 Introduction Landell Landell: Software to capture, record and stream audio and video in a simple way. Landell - live streaming

598 views • 12 slides

E Example l CSE 541 Numerical Methods Suppose we have three masses all connected by

E Example l CSE 541 Numerical Methods Suppose we have three masses all connected by Linear Systems y springs. i Each spring has the same constant k. constant k. Simple force balance gives us accelerations in terms of

353 views • 10 slides

PI ICR technique for high precision measurements of nuclide masses (development at

PI ICR technique for high precision measurements of nuclide masses (development at SHIPTRAP) Sergey Eliseev K. Blaum, M. Block, S. Chenmarev, A. Drr, C. Droese, T. Eronen, P. Filjanin, M. Goncharov, M. Hcker, J. Ketter, E. Minaya

1.16k views • 54 slides

Objective Taking recommendation technology to the masses Helping researchers and

Objective Taking recommendation technology to the masses Helping researchers and developers to quickly select, prototype, demonstrate, and productionize a recommender system Accelerating enterprise-grade development and deployment

820 views • 40 slides

Nuclear Structure Ingredients for reaction models Lecture 1 Nuclear ingredients for reaction

Nuclear Structure Ingredients for reaction models Lecture 1 Nuclear ingredients for reaction models Models available Masses and their importance Masses of nuclei Experimental masses Mass models Liquid-drop models

1.21k views • 85 slides

Sharks and Fish The sh are p oin ts with masses mo ving accord f

Sharks and Fish The sh are p oin ts with masses mo ving accord f ishm i ing to Newtons la ws F ma sub ject to an external force curren t The curren t dep ends on p

515 views • 9 slides

Probing Neutrino Masses and Mixings with Probing Neutrino Masses and Mixings with Accelerator and

1 Probing Neutrino Masses and Mixings with Probing Neutrino Masses and Mixings with Accelerator and Reactor Neutrinos Accelerator and Reactor Neutrinos Mike Shaevitz Shaevitz - Columbia University - Columbia University Mike Particles and

1.03k views • 68 slides

To The Masses With OpenACC John Urbanic What you (may) already know 1000 CPU Power (W) 100

Bringing GPU Computing To The Masses With OpenACC John Urbanic What you (may) already know 1000 CPU Power (W) 100 10 1990 1995 2000 2005 2010 2015 High Volume 2004 2006 2008 2010 2012 2014 2016 2018 Manufacturing Feature Size

700 views • 21 slides

1. Shapes and Masses of Nuclei Or: Nuclear Phenomeology References: [PRSZR 5.4, 2.3, 3.1/3; HG

PHYS 6610: Graduate Nuclear and Particle Physics I H. W. Griehammer INS Institute for Nuclear Studies The George Washington University Institute for Nuclear Studies Spring 2018 II. Phenomena 1. Shapes and Masses of Nuclei Or: Nuclear

457 views • 27 slides

Lambda-N and Sigma-N interactions from 2+1 lattice QCD with almost realistic masses H. Nemura 1 ,

Lambda-N and Sigma-N interactions from 2+1 lattice QCD with almost realistic masses H. Nemura 1 , for HAL QCD Collaboration S. Aoki 2 , T. Doi 3 , F. Etminan 4 , S. Gongyo 5 , T. Hatsuda 3 , Y. Ikeda 6 , T. Inoue 7 , T. Iritani 8 , N. Ishii 6 , D.

405 views • 38 slides

BIASES IN THE ESTIMATION OF GALAXY CLUSTER DYNAMICAL MASSES 3.5m TNG 10.4m GTC mm Universe @

BIASES IN THE ESTIMATION OF GALAXY CLUSTER DYNAMICAL MASSES 3.5m TNG 10.4m GTC mm Universe @ NIKA2, Grenoble 03-07 June 2019 Antonio Ferragamo THE CONTEXT PLANCK SZ CLUSTER CATALOGS PSZ1 PSZ2 Based on nominal mission data. Published in

441 views • 28 slides

Experimental Constraints on Experimental Constraints on 4th generation quark masses 4th

Experimental Constraints on Experimental Constraints on 4th generation quark masses 4th generation quark masses Work done with PQ Hung, arxiv:0711 4353 (PRD 2008) arxiv:0711.4353 (PRD, 2008) CDF -- PRD 76, 072006 (2007) But..

531 views • 21 slides